Unconditional Security of a Three State Quantum Key Distribution Protocol 
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Quantum key distribution (QKD) protocols are cryptographic techniques with security based only 
on the laws of quantum mechanics. Two prominent QKD schemes are the BB84 and B92 protocols 
that use four and two quantum states, respectively. In 2000, Phoenix et al. proposed a new family 
of three state protocols that offers advantages over the previous schemes. Until now, an error rate 
threshold for security of the symmetric trine spherical code QKD protocol has only been shown 
for the trivial intercept/resend eavesdropping strategy. In this paper, we prove the unconditional 
security of the trine spherical code QKD protocol, demonstrating its security up to a bit error rate 
of 9.81%. We also discuss on how this proof applies to a version of the trine spherical code QKD 
protocol where the error rate is evaluated from the number of inconclusive events. 

PACS numbers: 03.67.Dd 
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Quantum key distribution (QKD) protocols permit 
two separated parties, say Alice and Bob, to construct a 
secret shared string of bits that may be used for cryp- 
tography. The first QKD protocol, called BB84, was 
invented by Bennett and Brassard in 1984 l]. It re- 
quires Alice to randomly produce four different states 
|0), |1), |+), |— ) and send them through a quantum 
channel to Bob who measures them randomly in the 
{|0), |1)} basis or in its conjugate basis {|+), |— )}. The 
unconditional security of this protocol was first shown 
by Mayers in 1996 %. A simpler QKD protocol, B92, 
was proposed by Bennett in 1992 |g. It requires Al- 
ice to produce only two non-orthogonal states, say 
and 1^2)7 and Bob to perform the measurement de- 
scribed by the POVM (positive operator-valued measure) 
{a\^ 1 )(ip 1 \ 1 _a\i: 2 }(Tp 2 \,t~a\i; 1 }(TP 1 \-a\Tp 2 )(Tjj 2 \} 1 where 
|V>i) and \tjj 2 ) are orthogonal to \ipi) and \ip2), respec- 
tively, and a equals 1+ ^^ 2 ^ to optimize the proba- 
bility of a conclusive result to occur. Recent results by 
Tamaki et al. showed that B92 is secure for small noise, 
and the security threshold depends on qubit losses 0. 

Phoenix et al. 5] postulated that the addition of a 
third state to the B92 protocol could considerably en- 
hance its security and would be optimal if the three quan- 
tum states form an equilateral triangle on the X-Z plane 
in the Bloch sphere. We call this particular case the 
trine spherical code QKD protocol or the PBCOO proto- 
col. PBCOO is similar to B92, except that Alice randomly 
chooses two of three states for a basis instead of using two 
fixed states. From Eve's point of view, the state sent by 
Alice is a maximally mixed state, unlike in B92. This 
feature is similar to BB84, in which the choice of encod- 
ing basis by Alice corresponds to a random rotation (the 
identity or the Hadamard transformation). In PBCOO, 
the choice of encoding basis by Alice also corresponds to 
a rotation — by 120 degrees, 240 degrees, or none at all. 
Intuitively, we could expect to find a security threshold 



for PBCOO that is independent of qubit losses and that 
is close to the one of BB84. As we will explain in detail, 
our security proof also applies to a slightly modified ver- 
sion of the PBCOO protocol proposed by Renes Q that 
we will refer to as R04. In this protocol, the error rate 
is estimated from the number of inconclusive events, and 
all conclusive results can be used as data bits instead of 
wasting some as test bits. This also simplifies the classi- 
cal communication between Alice and Bob because they 
do not need to randomly select a set of test bits and 
broadcast them. 

Up to now, the high error rate threshold for the secu- 
rity of the PBCOO protocol has only been shown in the 
special case of the intercept/resend attack gj. In this 
Letter, we will give a proof of the unconditional security 
of the PBCOO and R04 protocols. Assuming one-way 
classical communication, we show that these protocols 
are secure up to a bit error rate of 9.81%. In order to es- 
tablish security, we first propose a QKD scheme based on 
an Entanglement Distillation Protocol (EDP) Q. This 
protocol uses a Calderbank, Shor, and Steane (CSS) 
code [U, a technique first used by Shor and Preskill in 
their security proof for BB84 . Before running an EDP 
based on CSS codes, Alice and Bob perform state rota- 
tions followed by Bob's local filtering operation (LF) ^(J . 
The local filtering operation correlates the phase and bit 
error rates, as in the security proof of B92 J4J. Thanks to 
the state rotation by Alice and Bob, we achieve phase er- 
ror estimation from bit error estimation. We will also ex- 
plain how the security of R04 follows from that of PBCOO. 

The PBCOO protocol involves three states = 

£10*) + ^|W, |^2) = 110,) - and |^ a ) = 

\0 X ), where {|0a;), |la:)} is a basis state (X-basis) of a 
qubit state. The Z-basis is defined by {\j z ) = [10,) + 
(—l)i\l x }]/y/2} (j — 0,1), and we also define states 
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respectively. The protocol proceeds as follows. 
PBCOO: 

1.1 Alice creates a large trit string r and a large bit string 
b of the same length. For each rj, the i th trit value of the 
trit string r, she chooses the set {IV'i)) IV^)} (if T{ = 0), 

(if r, = 1), and (if n = 2). If 

the i th bit value bi is 0, she prepares the first state of the 
chosen pair. If the bit is 1, she prepares the second state. 
Alice sends all prepared qubits to Bob. 

1.2 Bob performs a measurement described by the 
POVM {||^i)^i|,p 2 )#2|,f|^3)(^3|}. He publicly 
announces when all his measurements are done, and Alice 
in turn announces the trit string r. 

1.3 Bob regards the i th measurement outcome \-tpi) (if 
Ti = 0), |^2) (if Ti — 1), and |?/S 3 ) (if = 2) as the bit 
value 0. Similarly he regards ^2) (if U = 0), ji/^) (if r t = 
1), and l^i) (if = 2) as the bit value 1. All other events 
are regarded as inconclusive. Bob announces whether his 
measurement outcome is inconclusive or not. Alice and 
Bob keep all data where Bob's outcome is conclusive, 
discarding the rest. 

1.4 Alice randomly chooses half of the remaining events 
as test bits in order to estimate the bit error rate on 
the code bits, and announces her selection to Bob. They 
compare the values of their test bits, aborting the proto- 
col if the error rate is too high. 

1.5 By public discussion, they run classical error correc- 
tion and privacy amplification protocols to share a secure 
secret key. 

In order to prove the security of PBCOO, we relate this 
protocol to a secure QKD based on an EDP initiated 
by state rotations and a LF, followed by error correction 
using CSS codes 9] . The LF is designed so that it proba- 
bilistically distills the maximally entangled state |$ + ) = 
■j^{\0 z )\0 z ) + |l z )|l 2 )) if the filtering succeeds. Thus, 
the successful local filtering operation can be written by 
a Kraus operator F = |0 X )(0 X | + ^|l a ,)(l a; |. For later 

convenience, we define |$~) = -±=(\0 Z )\0 Z ) - |l 2 )|l a )), 
I**) = ^(|0 z )|l z )±|l 2 )|0 2 )),andi?. y (26V3)asa267r/3 
rotation around the Y-axis in the Bloch sphere. The 
following is the secure QKD based on an entanglement 
distillation protocol that will be reduced to PBCOO. 

QKD based on EDP: 

2.1 Alice creates many pairs of qubits in the state |</>) = 
^(|0*)a|V>i)b + |1 2 )a|-02)b), and randomly chooses a 
large trit string r whose length equals the number of pre- 
pared qubit pairs. She applies R y (2riTt /3) on the second 
qubit of every pair and sends them to Bob. 

2.2 Upon receiving the i th signal state, Bob determines 
whether the signal is in a qubit state or not which phys- 
ically corresponds to detecting a photon or not. If it is, 
he declares this publicly to Alice, who in turn declares 
the trit value r». Bob applies R y (— 2ri7r/3) on that qubit 
state followed by the filtering operation. In cases where 



the filtering operation does not succeed or Bob receives 
a state that is not a qubit state, he publicly tells Alice to 
discard her corresponding qubits. 

2.3 Alice randomly chooses half of the remaining states 
as test bits and the other half as code bits, and announces 
her selection to Bob. For the test bits, Alice and Bob each 
measure their halves in the Z-basis. By public discussion, 
they determine the number of bit errors. If the number of 
errors in the test bits is too high, they abort the protocol. 

2.4 By public discussion, Alice and Bob agree on an ap- 
propriate CSS code and run the EDP based on the CSS 
code to distill nearly perfect Bell states from the remain- 
ing qubit pairs (code pairs). 

2.5 Alice and Bob each measure the Bell pairs in the 
Z-basis to obtain a shared secret key 

First, we reduce this EDP based protocol into the 
PBCOO protocol. The reduction can be made in the man- 
ner of Shor and Preskill 9]. Their reduction technique 
implies that, in the context of QKD, the EDP based on 
CSS codes requires Alice to only perform Z-basis mea- 
surements immediately after she has prepared the state 
\<j)) and Bob to only perform Z-basis measurements im- 
mediately after he has performed the filtering operation. 
The Z-basis measurement, together with Alice's rotation, 
is equivalent to the situation where Alice randomly sends 
l^i}) 1^2), or ^3) to Bob. On Bob's side, the rotation 
followed by the filtering operation and Z-basis measure- 
ment is described by the following POVM, 

R y (2r i Tr/3)F"'\0 z )(0 z \FR y (-2r i n/3), 
R y (2r i Tr/3)F^\l z )(l z \FR y (—2r i Tr/3), 
i? y (2r l7 r/3)(l - F t F)il 3/ (-2r i 7r/3), (1) 

which are equivalent as a set to the POVM 
{§|^i)(^ll4fe)($2|,f|^3)(V'3|}, regardless of the trit 
value r, . Note that failing the filtering operation is equiv- 
alent to Bob measuring \ipj) when Alice encoded in the 
\tpj + 2)} basis in the PBCOO protocol. This com- 
pletes the reduction. 

The equivalence of the two schemes allows us to use the 
EDP-based protocol to prove the security of PBCOO. Se- 
curity follows by employing a result of Shor and Preskill. 
They showed that if the estimations of bit and phase error 
rates on the code pairs are bounded, except for a failure 
probability that becomes exponentially small as N in- 
creases, then Eve's mutual information on the secret key 
also becomes exponentially small as N increases. Here, 
N is the number of impure qubit code pairs. Since a 
large number of test bits yields an exponentially reliable 
estimation of the bit error rate on the code pairs, we only 
have to show how to estimate the phase error rate from 
the bit error rate on the code pairs in our protocol. In 
the case of BB84, it is trivial to deduce that the phase 
error rate must equal the bit error rate since the proto- 
col can be interpreted as Alice and Bob measuring all the 
time in the bit basis, but half the time, the bit errors are 
inverted with the phase errors. In the case of the three 
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state protocol, the phase error rate is five quarters of the 
bit error rare. However, the lack of symmetry caused by 
the filtering operation makes this more difficult to prove. 

To make the estimation of the phase error rate, we 
appeal to Azuma's inequality [Tl| . For a brief explana- 
tion of this inequality, consider N random, but depen- 
dent events. Let {j)"'}i=i jv be the set of probabilities 
of having a head in coin flipping for each event. Note 
that pw may depend on the results of the I — 1 previous 
events. Azuma's inequality tells us that if we perform 
all the N coin flips and if have n^ad head events, then 
the probability that the difference between rihcud/N and 

-pj is larger than some arbitrary small quantity 

drops exponentially as N increases. 
Proof of our claim: 

Definition: Suppose we have a series of events 
Fq,Fi,.... Let Xq,X\,... be random variables. The se- 
quence is a martingale iff the expectation of Xi + \ condi- 
tional to events Fi, Fi—%, ...Fq is equal to Xi for all i. 

Consider the case of N coin tosses, where the proba- 
bility of getting heads for each coin may be correlated in 
any way. Consider a series of events Fq,Fi, .... Let hi 
be the number of heads from the events F{, i^-i, ■■■Fq. 
Let Xi be hi — Ej=i P^ where p^> is the probability 
of obtaining a head on the j th coin conditional on events 
Fj—i, Fj-2, ■■■Fq. The expectation of Xi + i conditional on 
events Fj,Fi_i, ...Fq is hi — E}=iP pl us the expecta- 
tion of obtaining a head on the i + 1 coin, minus p( l+1 \ 
Since the expectation of obtaining a head on the i + 1 
coin minus p( l+1 "> is zero, the sequence X ,Xi,... is a 
martingale. 

Special Case of Azuma's Inequality: Let Xq, Xi, ... be a 
martingale sequence such that for each k, \X^ — Xfc_i| < 
1. Then, for all N > and any A > 0, 

Pr[\X N - X Q ] > A| < 2e~™. 

In the case of coin flipping introduced above, the con- 
dition \Xk — Xk-i\ < 1 is obviously satisfied. If we let 
A = Ne, then Azuma's inequality implies that 
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which proves our claim that the probability that the av- 

erage number of heads differs from — by more 

than an arbitrarily small quantity, e, drops exponentially 
as N increases. 
■ 

For the phase error estimations, we define {p^\l=x,..N 

and {Pphase}i=i,..JV as the sets of probabilities that Al- 
ice and Bob detect a bit error and a phase error re- 
spectively on the I th qubit pair after they have done the 
same measurements on the I — 1 previous pairs. Let ebit 
and e p hase be, respectively, the bit and phase error rates 
that Alice and Bob would have obtained if they had per- 
formed bit and phase error measurements on the code 



pairs. Azuma's inequality tells us that if Cp^ t — p p h asc 
is satisfied for all I and a particular value of C, then we 
have the exponentially reliable equality Ce^it = ephase- 
Since ebit gets exponentially closer to the bit error rate 
on the test bits, e orr , we only need to find a value for C . 

Before we try to obtain C, we must assume that Eve 
can do any coherent attack on all the qubits sent by 
Alice and that she can use all the ancillary qubits she 
wants. We will write a general equation for the state of 
the I th test pair depending on Eve's action. We must 
be careful to take into account that Alice and Bob's 
measurement outcomes on the previous I — 1 test pairs 
might affect the measurement outcome for I th test pair. 
Every qubit pair that has passed the filtering opera- 
tion has undergone Alice's rotation, Eve's global oper- 
ation and Bob's rotation followed by the filtering oper- 
ations. The reduced density operator of the I th qubit 
can be written as — | Eb=o 1 2 106 )(0fe Ij where- 
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Hj {-2bir/3)E^R y (2bir/3) \<j>), \<f>) is 

the state created by Alice in step 2.1 before she applies 
a rotation, and represents Eve's action restricted to 
the I th test pair. For simplicity, we will suppose that 
Eve's action can be written in the form of a single ma- 
trix E"' that needs not to be unitary. As it will soon be 
obvious, our final result still holds in the most general 
case, where Eve's action on the I th pair is represented by 
a superoperator satisfying ^jE^E^ < 1. Note that 
may depend on Eve or Alice and Bob's measurement 
outcome obtained from the previous /— 1 test pairs. Also 
note that we summed over the different values of &, since 
r was selected randomly and independently of the other 
operations done by Alice, Eve, or Bob. 

The probability of measuring a bit error on the I th 
test pair is p$ t = ^ 7 ((*+|p(0|*+) + (*-|p<9|*-)) 
and the probability of measuring 

f(0 = + ($-| p (0|$-)) 

(ty~\p( l '\ i Sr~)) is the probability that the filtering opera- 
tion succeeds on that qubit. Let us suppose that en, C12, 
C12 and C22 are the elements of E") in the X basis where 
the Cjj's are any complex numbers. Then, we easily ob- 



a phase error is 
\p®\i&~)), where 
((tf+|p(0|#+) 
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tain that |p bit = p ph 



Thus. 



we have C = |, and by 



the previous argument, we conclude that the phase error 
rate on the code pairs, e p hase, asymptotically approaches 
I ebit- This imply that from the measured bit error rate 
on the test pairs (e crr ), Alice and Bob can not only get an 
estimate of the bit error rate on the code pairs (ebit)> but 
can also deduce the phase error rate on them (e p hasc)- If 
Eve's action is represented by a general superoperator, 
then the above result still holds by linearity. Note that 
this argument is valid for any eavesdropping allowed by 
quantum mechanics because we allow {PuL}i=i,..n an d 
{Pu} t }l=i,..N to be arbitrary, including any correlations, 
and because the E^'s are also arbitrary. Thus, our es- 
timation is applicable to any attack, including coherent 
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attacks. 

Since we have the bit and phase error rates, we can cal- 
culate the secret key rate. The asymptotically achievable 
key generation rate for bit error rate e^t and phase er- 
ror rate e phaso is given by p conc [1 - h(e hit ) - h(e piiase )], 
where h{x) = — x\og 2 x — (1 — x) log 2 (l — x) is the bi- 
nary entropy [j| , and p C onc is the probability of conclusive 
events. In our case, the key generation rate is given by 
Pconc [l — M e err) — h(j e crr )] . From this we find that the 
PBCOO protocol is secure up to e orr « 9.81%, for which 
the key generation rate reaches 0. Contrary to the phase 
error estimation of B92 over lossy and noisy channel Q, 
this threshold is independent of the qubit losses because, 
in the previous analysis, we considered only the qubits 
that survived the filtering operation. 

In order to compare the security performance of the 
three-state protocol with the one of B92, BB84 and the 
six-state protocol (which is similar the BB84 except that 
Alice and Bob encode and measure in the X, the Z 
and also the Y basis), we assume that Eve simulates 
a depolarizing channel where a qubit state p evolves as 
(1 - p)p + | Y, a =x,v,x a aPv a - Here, a a is the Pauli op- 
erator for a component. It is known that B92, BB84 
and the six-state protocol are secure up to p « 3.4% [4|, 
p w 16.5% and p « 19.1% P3, respectively, while the 
three-state protocol is secure up to p « 15.2%. 

The above security proof also applies to the R04 proto- 
col 6]. It is similar to the PBCOO protocol, except that 
the rate of inconclusive events is used to estimate the 
bit error rate in conclusive events, instead of using test 
bits in step 1.5. In the following, we explain how that 
is possible. As a first step, we will make a clear distinc- 
tion between inconclusive results caused by qubit losses 
and those caused by qubits that have failed the filter- 
ing operation. From now on, inconclusive events exclude 
the qubits lost in the channel. In PBCOO, Alice ran- 
domly chooses which basis she uses before sending the 
state. Without threatening the security, we can mod- 
ify the protocol so that she sends a random state 



and waits until Bob has received it before choosing a ba- 
sis. For each state, Alice can randomly pick between two 
bases. The one that she chooses determines which result 
from Bob's POVM is inconclusive and which one will in- 
duce a "good" conclusive result (by good, we mean not an 
error). For Eve, there is no way to differentiate between 
the one that is inconclusive and the one that induces 
a "good" conclusive result. This implies that the num- 
ber of "good" conclusive results approximately equals the 
number of inconclusive results. Define / as the fraction of 
inconclusive results left after discarding the lost qubits. 
Then, (1 — ebit)(l — I) is close to /, where ebit repre- 
sent the error rate on all the conclusive events. More 
precisely, the probability that ebit and -j-^p are different 
by more than an arbitrary quantity goes exponentially 
small as the number of received qubits increases. Conse- 
quently, Alice and Bob can measure the error rate of the 
conclusive results by counting the number of inconclu- 
sive results. Note that the fraction of conclusive results 

IS Pconc = 2-e bit ^ 2 ' 

In this Letter, we have proven the unconditional secu- 
rity of the PBCOO and R04 protocols, the latter offering 
the ability to estimate the bit error rate without sacrific- 
ing test bits. Using one-way classical communication, we 
found an error rate threshold of 9.81%. As in the case 
of BB84, two-way classical communication could increase 
the threshold [l3|. We believe that Azuma's inequality, 
used in our security proof, might be useful in other QKD 
protocol security proofs. Finally, we note that the secu- 
rity proof in this Letter could likely be modified to show 
the unconditional security of the tetrahedron spherical 
code recently proposed by Renes @ or of a new three 
state QKD protocol robust against collective noise [l4| . 
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